CVE-2026-74447

A flaw was found in the Linux kernel's drm/amdkfd component. An integer overflow vulnerability exists when aligning the End-of-Pipe (EOP) ring buffer size. A local attacker could exploit this by providing a specially crafted size that, due to a 32-bit integer overflow, causes the system to bypass buffer size checks. This could lead to writes beyond the intended buffer, potentially causing a Graphics Processing Unit (GPU) fault and resulting in a Denial of Service (DoS).

A user controlled u32 EOP ring buffer size in amdkfd can overflow during PAGE_SIZE alignment because ALIGN keeps the calculation in 32 bit arithmetic. A value such as 0xFFFFF001 can wrap the aligned size to 0, bypassing the exact size check in kfd_queue_buffer_get and allowing a smaller BO to be accepted for the EOP ring. On affected GFX8 and GFX9 hardware the command processor may then program an 8KB EOP ring backed by a 4KB BO and write past the buffer, which can fault or hang the GPU. For the CVSS the PR:L is used because reliable triggering requires local access to the AMD KFD GPU interface, commonly through /dev/kfd or render device permissions, but not full administrator privileges. The issue is not network reachable. Impact is at least local denial of service through GPU fault or reset.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.